Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

4/1/2019
01:40 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Cybercriminals Using Popular TV Shows to Spread Malware

Illegally streamed episodes of Game of Thrones, The Walking Dead, and Arrow used by cybercriminals to deploy malicious files.

Woburn, MA – April 1, 2019 – New research from Kaspersky Lab has found that cybercriminals are actively using episodes of popular television shows to distribute malware to fans. “Game of Thrones,” “The Walking Dead” and “Arrow” are the shows most frequently used by attackers as a disguise for malicious files.

Television shows are a universal form of entertainment, and with the rise of online streaming, torrents and other methods of digital distribution, viewers are now able to access TV shows without having to tune in live. In many regions, popular programs are also consumed via illegal channels, such as torrent-trackers and unauthorized streaming platforms. Unlike legitimate resources, torrent trackers and hosted files may prompt a user to download a file that looks like an episode of a TV show, but is in fact malware with a similar name.

Seeing how easily TV shows downloaded from illegitimate resources can be replaced with malware-carrying versions, Kaspersky Lab researchers took a closer look at such compromised files from both 2017 and 2018. In both years, “Game of Thrones” led the list of TV shows targeted by cybercriminals to use as a disguise for malware. In 2018, the show accounted for 17 percent of all infected pirated content, with 20,934 attacked users.

This is despite the fact that in 2018, there were no new episodes of “Game of Thrones” released, while the other top shows in the rankings were promoted with high profile marketing campaigns. “The Walking Dead” was the next most popular show, with 18,794 users attacked, followed by “Arrow,” with 12,163.

In every case observed, the malware distributors focused on targeting the first and the last episode of each season, with the launch episode the most actively used. For example, the “Game of Thrones” Season 1 episode “The Winter is Coming” was the most commonly targeted episode of the show.

“We can see clearly that malware distributors exploit TV shows that are in high demand on pirated websites; these are usually actively promoted dramas or action series,” said Anton V. Ivanov, security researcher at Kaspersky Lab. “The first and final episodes, attracting the most viewers, are likely to be at greatest risk of malicious spoofing. Online fraudsters tend to exploit people’s loyalty and impatience, so may promise brand new material for download that is in fact a cyberthreat. Keeping in mind that the final season of ‘Game of Thrones’ starts this month, we would like to warn users that it is highly likely there will be a spike in the amount of malware disguised as new episodes of this show.”

To avoid falling victim to malicious files posing as TV show downloads, Kaspersky Lab recommends the following security tips for viewers:

  • Only use legitimate services with a proven reputation for producing and distributing TV content to view and download shows.
  • When downloading files, pay attention to the file extension. Even if you download TV show episodes from a source you consider trusted and legitimate, the file should have an .avi, .mkv or mp4 extension. Do not download the file if it is an .exe.
  • Pay extra attention to a website’s authenticity before streaming or downloading any shows. Confirm that a website is genuine by double- checking the format of the URL or the spelling of the company name before starting any downloads, and ensure the link starts with HTTPS://.
  • Do not click on suspicious links, such as those promising an early view of a new episode; check the TV-show schedule and keep track of it.
  • Use reliable security solution for comprehensive protection from a wide range of threats, such as Kaspersky Security Cloud.

The full text of Kaspersky Lab’s report, “Game of Threats: How Cybercriminals Use Popular TV Shows to Spread Malware,” is available on Securelist.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
CVE-2019-18197
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...
CVE-2019-4409
PUBLISHED: 2019-10-18
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entere...